Overview

overview

10

Static

static

1

plain.txt

windows10-2004-x64

7

plain.txt

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    plain.txt
  • Size 103B
  • Sample260722-stecfstyhv
  • SHA256 0156db8cb60e336f8b6e32ab72989aefcdccd9a14ff5b79900c7df56a4df5445
  • MD5 SHA1 SHA512 TLSH
Score
10/10
executionransomware

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://193.148.56.174/dl-callback/33f259cx-s9kx4wsc-r85cgscr-ns9vhbjg/HALIEMZK.msi/1d892ac55f8621ced9001e0f2cc1d668

Targets

    • Target
      plain.txt
    • Size 103B
    • SHA256 0156db8cb60e336f8b6e32ab72989aefcdccd9a14ff5b79900c7df56a4df5445
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    ransomwareexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Suspicious clipboard content.

      A suspicious script was copied to clipboard.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks